Cryptography bill of materials (CBOM) generation from binary executables

Abstract

A software package is received so that functions within the software package that implement or use cryptographic primitives can be identified. Further, a set of calls with each of the identified functions are determined. A call site analysis is performed based on the set of calls to determine cryptographic algorithm parameters. Thereafter, based on the set of calls and the call site analysis, a cryptography bill of materials (CBOM) detailing cryptographic primitives within the software package is generated. This CBOM can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.

What is claimed is: 
     
       1. A computer-implemented method comprising:
 receiving a software package comprising code; 
 identifying functions within the software package that implement or use cryptographic primitives by:
 conducting a similarity analysis to identify statically linked cryptographic library functions in the code; 
 performing a cross-reference analysis to identify unique cryptographic primitives in the code; 
 conducting a similarity analysis to identify statically linked cryptographic library functions in the code; and 
 identifying dynamically linked functions by way of indirect calls from exported functions to a third-party library which is dynamically linked during runtime; 
 
 determining a set of calls associated with each of the identified functions; 
 performing, based on the determined set of calls, a call site analysis to determine cryptographic algorithm parameters by:
 generating a call graph characterizing relationships amongst different functions in the code; and 
 identifying code relations on the call graph to collect all locations at which cryptographic code is used or called from; 
 
 generating, based on the set of calls and the call site analysis, a cryptography bill of materials (CBOM) detailing cryptographic primitives within the software package; and 
 providing the CBOM to a consuming application or process. 
 
     
     
       2. The method of  claim 1 , wherein the identification of functions further comprises:
 analyzing protocol globally unique identifiers (GUIDs) indicative of cryptography-related Unified Extensible Firmware Interface (UEFI) protocols. 
 
     
     
       3. The method of  claim 1 , wherein the identification of functions further comprises:
 analyzing import sections of the code to identify the dynamically linked functions. 
 
     
     
       4. The method of  claim 1 , wherein the algorithm parameters comprise one or more of: cipher modes, key sizes, parameter encoding, and parameter decoding. 
     
     
       5. The method of  claim 1 , wherein the call site analysis further comprises:
 generating a control flow graph; 
 performing control flow analysis on the control flow graph to identify specific modes of operation of a cipher. 
 
     
     
       6. The method of  claim 1 , wherein the call site analysis further comprises:
 emulating at least a portion of the code to identify specific modes of operation of a cipher. 
 
     
     
       7. The method of  claim 1 , wherein the call site analysis further comprises:
 emulating at least a portion of the code to reconstruct the cryptographic algorithm parameters. 
 
     
     
       8. The method of  claim 1 , wherein the identification of functions further comprises:
 generating an intermediate representation for each function; 
 generating, for each intermediate representation, an embedding; 
 extracting, for each function, features from both of the corresponding intermediate representation and the embedding; 
 inputting, for each function, the corresponding extracted features into a machine learning model trained and configured to identify functions or components comprising cryptographic primitives. 
 
     
     
       9. The method of  claim 1  further comprising:
 initiating one or more remediation actions based on the CBOM. 
 
     
     
       10. The method of  claim 9 , wherein the initiated one or more remediation actions comprise: blocking access to some or all of the software package. 
     
     
       11. The method of  claim 9 , wherein the initiated one or more remediation actions comprise: flagging one or more components within the software package as comprising cryptographic primitives. 
     
     
       12. A computer-implemented method comprising:
 receiving a software package comprising components executing a plurality of functions; 
 identifying functions within the software package that implement or use cryptographic primitives, the identification of functions comprising: identifying dynamically linked functions by way of indirect calls from exported functions to a third-party library which is dynamically linked during runtime; 
 generating, for each function, a corresponding intermediate representation; 
 generating, for each intermediate representation, a corresponding embedding; 
 extracting features from each of the intermediate representations and the corresponding embedding; 
 determining, using at least one machine learning model and the extracted features, a set of calls associated with each of the identified functions; 
 performing, based on the determined set of calls, a call site analysis to determine cryptographic algorithm parameters by:
 generating a call graph characterizing relationships amongst different functions in the code; and 
 identifying code relations on the call graph to collect all locations at which cryptographic code is used or called from; 
 
 generating, based on the set of calls and the call site analysis, a cryptography bill of materials (CBOM) detailing cryptographic primitives within the software package; and 
 providing the CBOM to a consuming application or process the consuming application or process initiating at least one remediation action based on the CBOM. 
 
     
     
       13. A system comprising:
 at least one data processor; and 
 memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
 receiving a software package comprising code; 
 identifying functions within the software package that implement or use cryptographic primitives by conducting three or more of:
 conducting a similarity analysis to identify statically linked cryptographic library functions in the code; 
 performing a cross-reference analysis to identify unique cryptographic primitives in the code; 
 performing a cross-reference analysis to detect statically linked cryptographic library functions; 
 analyzing protocol globally unique identifiers (GUIDs) indicative of cryptography-related Unified Extensible Firmware Interface (UEFI) protocols; and 
 analyzing import sections of the code to identify dynamically linked functions, the dynamically linked functions being identified by way of indirect calls from exported functions to a third-party library which is dynamically linked during runtime; 
 
 determining a set of calls associated with each of the identified functions; 
 performing, based on the determined set of calls, a call site analysis to determine cryptographic algorithm parameters; 
 generating, based on the set of calls and the call site analysis, a cryptography bill of materials (CBOM) detailing cryptographic primitives within the software package; and 
 providing the CBOM to a consuming application or process. 
 
 
     
     
       14. The system of  claim 13 , wherein the call site analysis further comprises:
 generating a control flow graph; 
 performing control flow analysis on the control flow graph to identify specific modes of operation of a cipher; 
 emulating at least a portion of the code to identify specific modes of operation of a cipher; and emulating at least a portion of the code to reconstruct the cryptographic algorithm parameters. 
 
     
     
       15. The system of  claim 13 , wherein the identification of functions further comprises:
 analyzing import sections of the code to identify the dynamically linked functions. 
 
     
     
       16. The system of  claim 13 , wherein the algorithm parameters comprise one or more of: cipher modes, key sizes, parameter encoding, and parameter decoding. 
     
     
       17. The system of  claim 13 , wherein the call site analysis comprises:
 generating a control flow graph; 
 performing control flow analysis on the control flow graph to identify specific modes of operation of a cipher. 
 
     
     
       18. The system of  claim 17 , wherein the call site analysis further comprises:
 emulating at least a portion of the code to identify specific modes of operation of a cipher. 
 
     
     
       19. The system of  claim 17 , wherein the call site analysis comprises:
 emulating at least a portion of the code to reconstruct the cryptographic algorithm parameters. 
 
     
     
       20. The system of  claim 17 , wherein the identification of functions further comprises:
 generating an intermediate representation for each function; 
 generating, for each intermediate representation, an embedding; 
 extracting, for each function, features from both of the corresponding intermediate representation and the embedding; 
 inputting, for each function, the corresponding extracted features into a machine learning model trained and configured to identify functions or components comprising cryptographic primitives. 
 
     
     
       21. The system of  claim 17 , wherein the operations further comprise:
 initiating one or more remediation actions based on the CBOM comprising blocking access to some or all of the software package.